Chapter 22 Configuring a Certificate Manager for Publishing

Netscape Certificate Management System (CMS) provides a customizable publishing framework for the Certificate Manager. This chapter explains how to configure the Certificate Manager to publish to an LDAP directory, a flat file, and an online validation authority.

• Publishing Certificates and CRLs to a Directory
• Publishing Certificates and CRLs to Flat Files
• Publishing CRLs to Online Validation Authority
• Managing Mapper and Publisher Modules

• When the Certificate Manager starts up, it publishes its CA certificate to the configured directory.
• When the Certificate Manager issues a new certificate (the request may originate from a Registration Manager), it publishes the certificate to the configured directory.
• When the Certificate Manager revokes a certificate (the request may originate from a Registration Manager), it removes that certificate from the configured directory.
• When a certificate expires, the Certificate Manager can remove that certificate from the configured directory. The server uses the Job Scheduler component to accomplish this task; see "Directory Update and Notification").
• When the certificate revocation list is created or updated (either through the CMS window or through the certificate-revocation feature provided in the agent or end-entity interface), the Certificate Manager publishes that list to the configured directory.

• Step 1. Plan
• Step 2. Set Up the Directory for Publishing
• Step 3. Configure the Certificate Manager to Publish Certificates
• Step 4. Configure the Certificate Manager to Publish CRLs
• Step 5. Identify the Publishing Directory
• Step 6. Test Certificate and CRL Publishing (optional)

Before configuring a Certificate Manager to publish its CA certificate, end-entity certificates, and CRLs to a directory, do this:

• Read "Publishing of Certificates to a Directory"and "Publishing of CRLs to an LDAP Directory" to understand how the Certificate Manager publishes certificates and CRLs to the directory.
• Read sections "Mapper Modules" and "Publisher Modules". Be sure to take a look at the default mappers and publishers created during CMS installation and determine whether they are suitable for your setup. If they're unsuitable, decide on the mapper and publisher modules you want to use.
• If you decided to not use the default mappers created using the LdapCaSimpleMap module, you will be required to manually create an entry for the CA in the publishing directory. (This document explains how to create an entry for the CA in Netscape Directory Server, version 4.x only.)
• Read "Publishing of CRLs". Determine whether you want the Certificate Manager to publish version 1 or version 2 CRLs to the directory. If you decide to publish version 2 CRLs, read "CRL Extension Modules" and determine the CRL extensions you want the Certificate Manager to set; you will be required to configure the server to set these extensions.
• Identify your publishing directory. If you've already configured the Certificate Manager to use an LDAP directory for authenticating users (for example, if you're using the directory-based or directory- and PIN-based authentication), you should consider publishing certificates and CRLs to the same directory. This way, users' security credentials will be kept with the rest of the user information.
• Note the following information for the directory: the host name, the port number, and the port type--whether it's an SSL or nonSSL port.
• Determine how you want the Certificate Manager to authenticate to the directory: whether to publish with basic authentication, publish over SSL without SSL client authentication, or publish over SSL with SSL client authentication. Accordingly, you will need to configure the Directory Server.
• If you want the Certificate Manager to authenticate to the directory using SSL client authentication, determine the certificate the Certificate Manager must use for SSL client authentication. By default, the server uses its SSL server certificate; see "SSL Server Key Pair and Certificate".

Depending on your PKI setup, you may use an external CA for requesting the certificate. For example, if your Certificate Manager is a subordinate CA to an external CA, you can get the Directory Server's certificate signed by the same CA that signed your Certificate Manager's certificate.

• If certificates the Directory Server and Certificate Manager will use during SSL-enabled communication already exist, check the CA that issued these certificates. The CA that issued the Directory Server's SSL server certificate must be trusted by the Certificate Manager. Similarly, the Directory Server must trust the CA that issued the certificate the Certificate Manager will use for client authentication.
• Determine how you want the Certificate Manager to bind to the directory: whether to bind as CN=directory manager or as another user; if it's another user, the entry must have read-write privileges to the directory tree that contains entries for end-entities to whom you intend to issue certificates.
• If you're not the directory administrator, consult the directory administrator about making changes to the schema, if required.
• Keep your directory documentation handy. For an online version of Netscape Directory Server 4.x documentation, check this file:

<server_root>/manual/index.html

You can find documentation for other versions of Netscape Directory Server at this site:

http://docs.iplanet.com/docs/manuals/directory.html

For a Certificate Manager to publish certificates and CRLs to an LDAP directory, the directory needs to be set up to receive certificate- and CRL-related information from the Certificate Manager.

• Step A. Verify the Directory Schema
• Step B. Add an Entry for the CA
• Step C. Identify an Entry That Has Write Access
• Step D. Verify Entries for End Entities
• Step E. Specify the Directory Authentication Method
• Step F. Modify the Certificate Mapping File
• Step G. Restart Directory Server

For a Certificate Manager to publish certificates and CRLs to a directory, it must be configured with specific attributes and object classes. This section discusses those basic schema requirements. Is it assumed that you're familiar with directory schema and related terminology. If you're not, check the Directory Server documentation.

The Certificate Manager publishes an end entity's certificate to the userCertificate;binary attribute within the end entity's or subject's directory object. This attribute is multivalued; each value is a DER encoded binary X.509 certificate. The LDAP object class named inetOrgPerson allows this attribute. This object class is supported by Netscape Directory Server versions 1.0, 3.x, and 4.x. The mix-in object class named strongAuthenticationUser allows this attribute and can be combined with any other object class to allow certificate publication to that object. Note that the Certificate Manager does not automatically add this object class in the schema table of the corresponding Directory Server while publishing or unpublishing end-entity certificates. If the directory object that it finds does not allow the userCertificate;binary attribute, the addition or removal of that specific certificate fails.

The Certificate Manager publishes its own CA certificate in the caCertificate;binary attribute of the CA's directory object when the server is started; this is the object that corresponds to the Certificate Manager's issuer name. This is a required attribute of the certificationAuthority object class. Note that the Certificate Manager will add this object class to the directory entry for the CA, provided that it finds the CA's directory entry.

The Certificate Manager maintains its list of revoked certificates in its internal database; this list is called the certificate revocation list (CRL). You can configure the server to publish the CRL to the directory whenever it is generated, which could be when a certificate is revoked and at regular intervals. You can also manually trigger the server to generate a CRL and publish it to the directory.

Complete this step only if you want to manually create an entry for your CA in the directory--that is, you do not want use the automated feature built into the LdapCaSimpleCAMap plug-in module for creating the CA's entry in a directory; see "CA Certificate Mapper".

• If your CA's distinguished name begins with the CN component, create a new person entry for the CA. (If you select a different type of entry, the interface may not allow you to specify a value for the CN component.)
• If your CA's distinguished name begins with the OU component, create a new organizational unit entry for the CA.

1. Log in to Netscape Console (see "Logging In to Netscape Console").
2. Locate the Directory Server instance you want the Certificate Manager to use for publishing certificates and CRLs.
3. Double-click the instance or select the instance and click Open.

This opens the Directory Server window.

4. Select the Directory tab.
5. Select the domain name, right click, select New, and then select Other.

The "New object" window appears.

6. Select "person" and click OK.

The Property Editor - New window appears.

7. Enter the required information.

Full name. Enter the common name (the value of the CN component) of the CA exactly as it appears in the issuer DN; this DN shows up in the CA's signing certificate. For example, if your CA's issuer DN is CN=testCA, OU=Research Dept, O=Siroe Corporation, ST=California, C=US, you should enter testCA in this field.

Last name. Enter the name again; it must be the same as the one you entered in the "Full name" field.

8. Keep the default values in the remaining fields, and click OK.

The new entry appears in the Directory tab.

9. Verify that the entry has been created.
1. Double-click Directory Administrators, click Members, and then click Add.
2. Search for the user entry you added earlier.
3. Click OK and again OK.

When you configure the Certificate Manager to work with Directory Server, you'll be required to specify a distinguished name in the directory that has read-write permissions to the directory. To publish certificates and CRLs to the directory, the Certificate Manager needs to use a user entry (in the directory) that has write access to the directory. This enables the Certificate Manager to bind to the directory as this user and modify the user entries with certificate-related information and the CA entry with CA's certificate and CRL related information.

• Use the DN of an existing entry that has write access. For example, you can use the entry of the Directory Manager or choose an alternative.
• Give write access to the user entry you created for the Certificate Manager in the previous step. The entry can be identified by the Certificate Manager's DN. For example, it may look like this:

CN=testCA, OU=Research Dept, O=Siroe Corporation, ST=California, C=US

The publishing directory must contain an entry for each end entity for whom you want a certificate published. If the end entity does not have an entry in the directory, the Certificate Manager will not be able to publish the end entity's certificate.

Step E. Specify the Directory Authentication Method

Depending on how you want the Certificate Manager to authenticate to the directory, you must set up Directory Server for one of the following methods of communication:

• Publishing With Basic Authentication
• Publishing Over SSL Without Client Authentication
• Publishing Over SSL With Client Authentication

To configure Directory Server for basic authentication:

1. Go to the Directory Server window.
2. Select the Configuration tab, and then in the right pane, select the Encryption tab.
3. Make sure that the Enable SSL box is unchecked. If it's checked, uncheck it.
4. Click Save.

You are prompted to restart the server. Don't restart the server yet; you can do this after you've made all the configuration changes.

To configure the Directory Server for SSL-enabled communication:

1. Go to the Directory Server window.
2. Select the Configuration tab, and then in the right pane, select the Encryption tab.
3. Check the Enable SSL box.
4. In the Cipher Family section, check the RSA box.
5. Click the Cipher Preferences button and select the appropriate SSL ciphers.

For details on individual ciphers, click the Help button.

6. In the Client Authentication section, select the "Allow client authentication" option.

Be sure not to select the "Require client authentication" option. If you do, Netscape Console will not be able to communicate with the directory.

7. Click Save.

You are be prompted to restart the server. Don't restart the server yet; you can do this after you've made all the configuration changes.

For the Certificate Manager to publish to the directory with SSL client authentication, Directory Server must

• Contain an SSL server certificate in its certificate database
• Trust the CA that issued its SSL server certificate
• Trust the CA that issued the certificate the Certificate Manager will use for SSL client authentication
• Use a valid, secure port number for communication with the Certificate Manager
• Have SSL-enabled communication turned on in its configuration

1. Go to the Directory Server window.
2. Select the Tasks tab.
3. From the Console menu, choose the Manage Certificates option.

The Certificate Management dialog box appears showing a list of all the certificates installed for Directory Server.

4. Scroll through the list to see if it contains the SSL server certificate that you want to use.
• If the server has an SSL server certificate, check the CA that has issued the certificate. If this CA is trusted by the Certificate Manager, you can configure Directory Server to use the same certificate. If the CA is untrusted by the Certificate Manager and you want the Certificate Manager to trust it, you need to check the Certificate Manager's certificate database for the CA certificate, add it if it isn't present, and specify that it be trusted. For instructions on manipulating the Certificate Manager's certificate database, see "Changing the Trust Settings of a CA Certificate".

After you've made sure that the CA is trusted by the Certificate Manager, go to "Step 10. Verify the Port Number".

• If the server does not have an SSL server certificate, or if you don't want the Certificate Manager to trust the CA that has issued the Directory Server's certificate, you must get an SSL server certificate for the Directory Server from a CA that is trusted by the Certificate Manager. You may get this certificate from the Certificate Manager itself.

The instructions that follow (Step 2 through Step 9) explain how to do this.

• If you want to request the certificate from an external CA, you should click the Show CA button to see whether the CA of your interest is listed there. If it is listed, you can open the SSL server enrollment interface of that CA so that you can paste the CSR the wizard will generate.
• If you want to request the certificate from the Certificate Manager, there are three possible ways in which you can submit the CSR to the Certificate Manager:
• Submit the CSR directly from the wizard; in this method, you do not need to copy the CSR the wizard generates.
• Submit the CSR as an email to the CA's administrator; to use this method, you need to know the email address of the person who processes certificate requests for the CA and you need to copy the CSR the wizard generates.
• Submit the CSR manually by pasting it into the Certificate Manager's SSL server enrollment form; to use this method, you need to copy the CSR the wizard generates.

1. In the Directory Server window, select the Tasks tab, and then click the Certificate Setup Wizard button.
2. Select the token for generating the key pair (and for storing the certificate). Since you don't have the certificate, select No.

If you're generating the certificate for the first time, the wizard informs you that it needs to create a trust database (cert7.db and key3.db files) for Directory Server.

3. When prompted for the password, enter the password.

Remember this password because you will be required to supply it when starting Directory Server from now on.

Once the trust database is generated, the wizard steps for generating the CSR begin.

4. You are asked to specify whether the certificate is for a new key pair or an existing key pair and the method for submitting the CSR to the CA.

   

The choices for submitting the CSR to the CA include the following:

To CA's email address. Select this if you want to send the CSR to the CA administrator's email address. Type the administrator's email address (for example, jdoe@siroe.com) in the adjoining field. The administrator will then be required to submit the request to the CA by pasting the CSR in the CA's server enrollment form.

To CA's URL. Select this if you want to submit the CSR to the Certificate Manager directly. Depending on the end-entity port that's enabled, type either of the following URL:

http://<CA's_host_name>:<end_entity_port>/enrollment

or

https://<CA's_host_name>:<end_entity_SSL_port>/enrollment

Note that the request submitted to the CA's URL gets queued for approval by the Certificate Manager agent.

5. When the wizard displays the CSR, if you are running the wizard on a Windows NT system, copy the CSR (displayed in its base-64 encoded format) to a text file. The information you copied should look similar to the sample shown below. Do not make any changes to it. (As indicated in the message, a copy of this information is also saved to the /temp file in the host machine's file system.)

-----BEGIN NEW CERTIFICATE REQUEST-----

MMIIBnzCCAQgCAQAwXzELMAkGA1UEBhMCVXMxEzARBgNVBAgTCkNBTElGT1JOSUExHTAbBgNVBAo
pME5ldHNjYXBlIENvbW0uIENvcnAuMRwwGgYDVQQDExNzdXByaXlhLW50Lm1jb20uY29tMIGfMA0G
CSGSIb3DQEBAQUAA4GNADCBiQKBgQCk49jBib3SZQqTt5YtIGugnVOq38Y1CcB9xowCsapR+DIow8
MUVWGRUT38mcX0lfpNT4hzW1aePiHersIMZFLxRgel0kEtJ0ClWfNQKzrnOfpL1H3CjcLjSM5hWaF
t0M5hfZEtPk+XBsMbu3dCtbRacxs0M2I0AVkf+kp24ePvqD8QIDAQABoAAwDQYJKoZIhvcNAQEE
BQADYEAdE0hZFHK6fAonMnHmNz46M96qqgtjwO3R9alt1l+0YWKslCjf+ThG38adNw1aH0qioW7yl
THJhpHF48M3SmmTqR7S3yKg+3ECLWbMYmUmd2wNTxsIdD4r8ySByxMIncVSvCjFOHJnifZCUqr+0N
ukZnqhDWqy0vqrGW71akstyyttdtttyyy790bfgfiwrytdnbjdgnhffnb0hgjyu08o=po=9=

-----END NEW CERTIFICATE REQUEST-----

1. Open a web browser window.
2. Go to the end-entity interface of the Certificate Manager (or to the Registration Manager that's connected to the Certificate Manager).
3. In the left frame, under Server, click SSL Server.
4. In the server enrollment form that appears, enter the required information:

PKCS#10 Request. Paste the base-64 encoded blob, including the -----BEGIN NEW CERTIFICATE REQUEST----- and -----END NEW CERTIFICATE REQUEST----- marker lines, you copied to the text file earlier.

Name. Type your name.

Email. Type your business email address, for example, jdoe@siroe.com.

Phone. Type your business phone number.

Additional Comments. Type any information that will help you identify this request in the future or will help the person who will process this request.

5. Click Submit.

1. In the browser window, go to the Certificate Manager Agent Services interface. (If you submitted the request to a Registration Manager, go its agent interface.)
2. In the left frame, select List Requests. In the form that appears, select the "Show pending request" option and click Find.
3. In the request queue, locate the request you submitted and click Details.
4. Verify the information and click Do It.

If your request contained all the required information, the server issues a certificate and you should see a message indicating so.

5. Click Show Certificate.

The complete details about the certificate appear. Don't close the page; in the next step, you'll need to copy the certificate from this page.

• If you submitted the CSR to an external CA, wait till you receive the certificate. When you receive the certificate, look for the base 64-encoded blob of the certificate.
• If you submitted the CSR to the Certificate Manager, check the confirmation page that you received in the previous step; it contains the certificate in its base 64-encoded format.

1. In the page that shows the certificate details, scroll down to the section that says "Installing this certificate in a server".
2. Copy the base-64 encoded certificate, including the ----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- marker lines, to a text file or to the clipboard; be sure not to make any changes to the text blob. An example of the information you should copy is shown below:

-----BEGIN CERTIFICATE-----

MMIICVDCCAf6gAwIBAgIBDDANBgkqhkiG9w0BAQQFADB6MQswCQYDVQQGEwJVUzELMAkGA1UECBM
Q0M0ExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxETAPBgNVBAoTCE5ldHNjYXBlMRUwEwYDVQQLEwx
TZW1cml0eVB1YnMxHDAaBgNVBAMTE0NlcnRpZmljYXRlIE1hbmFnZXIwHhcNOTkwNzA5MjIxNjQ5W
hcMDAwNzA4MjIxNjQ5WjCQYDVQQGEwJVczETMBEGA1UECBMKQ0FMSUZPUk5JQTEdMBsGA1UEChMUT
m0c2NhcGUgQ29tbS4gQ29ycC4xHDAaBgNVBAMTE3N1cHJpeWEtbnQubWNvbS5jb20nbh4++oPxAgM
AAGjRjBEMBEGCWCGSAGG+EIBAQQEAwIGQDAOBgNVHQ8BAf8EBAMCBPAwHwYDVR0jBBgFoAUXuCIMl
07LCdanaxlek5DlpU4cxLgwDQYJKoZIhvcNAQEEBQADQQCagJsZwKG2usqiQ+bmZ0TJb44XhXDLRY
1GkbXtNLLf5acA1iBvi0cbEG5UsZk5zdB5zSDDe7Tuk9HrbyQrtQ6F

-----END CERTIFICATE-----

1. Go to the Directory Server window.
2. Start the Certificate Setup Wizard.
3. In the first step that the wizard displays, select the "Install Certificate for This Server" option.
4. In the second step, select the "The certificate is located in the following text field" option and paste the certificate blob, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- marker lines, you copied earlier.
5. Follow the prompts and add the certificate to the certificate database.

1. Go to the end-entity interface of the Certificate Manager (or to the Registration Manager that's connected to the Certificate Manager).
2. Click the Retrieval tab.
3. In the left frame, click Import CA Certificate Chain.
4. In the form that appears, select the "Display the CA certificate chain in PKCS#7 for importing into a server" option, and click Submit.

The CA certificate chain appears.

5. Copy the base-64 encoded certificate blob, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- marker lines, to a text file or the clipboard.

1. Go to the Directory Server window.
2. Start the Certificate Setup Wizard.
3. Select the option to install a certificate for a trusted certificate authority.
4. Select the "The certificate is located in the following text field" option and paste the certificate blob, including the -----BEGIN CERTIFICATE---- and -----END CERTIFICATE----- marker lines, you copied earlier.
5. Follow the prompts and add the CA certificate chain to the certificate database of Directory Server.

1. In the Directory Server window, select the Tasks tab.
2. From the Console menu, select Manage Certificates.

The Certificate Management dialog box appears showing a list of certificates installed for Directory Server.

3. Scroll through the list. You should find the certificates you installed. If you find the certificates, your server is ready for SSL activation.

1. In the Directory Server window, select the Configuration tab, and then in the navigation tree, select the root (the topmost) item.
2. Select the Settings tab in the right pane.

Port. Type the port number you want the server to use for non-SSL communication. The default port number is 389.

Encrypted Port. Type the port number you want the server to use for SSL-enabled communication. The default secure port number is 636. The encrypted port number that you specify must not be the same as one you specified in the Port field.

3. Click Save.

You are be prompted to restart the server. Don't restart the server yet; you can restart it after you've made all the changes.

Be aware that changing the Directory Server port number requires you to change the corresponding port number in all other servers that communicate with the directory. For example, if you have other Netscape Servers installed that point to the directory, you need to update those server configurations to use the new port number. For details, see Managing Servers with Netscape Console (to locate this document, see <server_root>/manual/index.html).

1. In the Directory Server window, select the Configuration tab, and then in the right pane, select the Encryption tab.
2. Check the Enable SSL box.
3. In the Cipher Family section, check the RSA box.
4. Click the Cipher Preferences button and select the appropriate SSL ciphers.

For details on individual ciphers, click the Help button.

5. In the Token drop-down list, select the token that contains the key pair for the certificate you installed (or for the certificate you want the server to use).
6. Select the certificate you want the server to use during SSL-enabled communication with the Certificate Manager.
7. In the Client Authentication section, select the appropriate option:

Do not allow client authentication. Select this if you want to configure the directory for basic authentication or for SSL-based communication without client authentication.

Allow client authentication. Select this if you want to configure the directory for SSL client authenticated communication.

Require client authentication. Don't select this option. If you do, Netscape Console will not be able to communicate with Directory Server. This is because Netscape Console does not support client-authenticated communication yet. For example, if you're using the same directory for user data and configuration information of other Netscape servers and if you configure Directory Server to require client authentication, you will no longer be able to manage your Netscape servers from Netscape Console; instead, you will be required to use the command-line tools.

8. Click Save.

You are prompted to restart the server. Don't restart the server yet; you can restart it after you've made all the required changes.

This step explains how to modify the certmap.conf file to add a certificate mapping rule for the CA's entry you created. You need to go through this step only if you configured the directory for SSL client authenticated communication. Otherwise, skip to "Step G. Restart Directory Server".

• Where in the directory tree the server should begin its search for locating the entry in the directory
• What certificate attributes the server should use as search criteria when searching for the entry in the directory
• Whether the server needs to go through any additional verification process

certmap <name> <issuerDN>

<name>:<property1> [<value1>]

<name>:<property2> [<value2]

...

<name>:<propertyn> [<valuen]

The first line specifies a name for the entry and the DN of the issuer of the client certificate--in this case, the issuer of the certificate the Certificate Manager will present during client authentication. (By default, the Certificate Manager uses its SSL server certificate generated during installation.) The name is arbitrary; you can define it to be whatever you want. However, the issuer DN must exactly match the issuer DN of the CA that has issued the certificate the Certificate Manager will use for client authentication. For example, the following two issuer DN lines differ only in the number of spaces separating the attribute value assertions (AVAs), but the Directory Server will treat these two entries as different:

• DNComps--This is a list of comma-separated DN attribute tags used to determine where in the directory the server should start searching for directory entries that match the Certificate Manager's information (that is, the owner of the client certificate). The Directory Server gathers values for these tags from the certificate presented by the Certificate Manager during client authentication and uses the values to form an LDAP DN, which then determines where the server starts its search in the directory. For example, if you set DNComps to use the <O=org> and <C=country> DN attribute tags (DNComps=O,C) the server starts the search from the O=<org>, C=<country> entry in the directory, where <org> and <country> are replaced with values from the values specified in the subject DN of the certificate presented for client authentication.
• If the DNComps entry is present but has no value, the server searches the entire LDAP tree for entries matching the filter.
• If there isn't a DNComps entry in the mapping, the server uses either the CmapLdapAttr setting (if present) or the entire subject DN in the Certificate Manager's certificate.

The following component tags are supported for DNComps: CN, OU, O, C, L, ST, E, and Mail. Case is ignored. You can use E or Mail, but not both.

• FilterComp--This is a list of comma-separated DN attribute tags used to create a filter by gathering information from the subject DN in the certificate presented during client authentication. Directory Server uses the values for these tags to form the search criteria for matching entries in the directory. If Directory Server finds one or more entries in the directory that match the Certificate Manager's information gathered from the certificate, the search is successful and the server optionally performs a verification. For example, if FilterComps is set to use the attribute tags E and UID (FilterComps=E,UID), the server searches the directory for an entry whose values for E and UID match the Certificate Manager's information gathered from the client certificate. Email addresses and user IDs are good filters because they are usually unique entries in the directory.

Note that the filter needs to be specific enough to match only the Certificate Manager's entry in the LDAP directory. The following component tags are supported for FilterComps: CN, OU, O, C, L, ST, E, and Mail. Case is ignored. You can use E or Mail, but not both.

• verifycert--This tells the server whether it should compare the certificate the Certificate Manager presents during client authentication with the certificate found in the Certificate Manager's entry in the directory. It takes one of the two values: on or off. It is recommended that you set this to on for a complete single sign-on solution. This ensures that Directory Server will authenticate the Certificate Manager unless the certificate presented exactly matches the certificate stored in the directory.

certmap default default

default:dnComps

default:filterComps E, UID

certmap MyCA CN=CA,OU=MyGroup,O=MyCompany,C=US

MyCA:dnComps OU,O,C

MyCA:filterComps E

MyCA:verifycert on

1. In the Directory Server host machine, go to this directory:
   <server_root>/shared/config
2. Open the certmap.conf file in a text editor.
3. Follow the instructions in the file and add the mapping information for the entry you added.

   

The figure above shows the following mapping rule being added to the file:

certmap myCA CN=rootCA, O=siroe.com

#myCA:DNComps

myCA:FilterComps

This mapping rule specifies that if the name of the CA that signed the certificate used for SSL client authentication by the Certificate Manager is myCA and that the issuer name or DN of the CA is CN=rootCA, O=siroe.com, the server should use the FilterComps attributes to locate the entry.

If you determine that the certmap.conf file needs an empty DNComps mapping (because your certificate subject name has no overlap with the corresponding directory DN), you may need to modify the default base DN in Directory Server by adding the following to the Directory Server configuration file:

dn: cn=config

changetype: modify

replace: nsslapd-certmap-basedn

nsslapd-certmap-basedn: dc=siroe, dc=com

4. Save your changes, and close the file.

For all your changes to take effect, you must restart Directory Server.

• Starting Directory Server

If you configured the Directory Server for basic authentication or SSL- enabled communication without client authentication, you can start the server from the Directory Server window from within Netscape Console:

1. Click the Tasks tab.
2. Click Restart the Server.

• Starting SSL-Enabled Directory Server

If you configured the Directory Server for SSL-enabled communication with client authentication, here's how you must start the server:

• On Windows NT, start the server from the server's host machine and supply the PIN or password that protects the key pair you generated for the Directory Server's certificate. For security reasons, the dialog box that prompts you for this PIN appears only on the server's host machine.
• On Unix, start the server from the command line.

This section explains how to specify certificate mapping and publishing rules the Certificate Manager should use to publish certificates to the correct entries in the directory.

• Step A. Modify the Default Mappers, Publishers, and Publishing Rules
• Step B. Add Mappers, Publishers, and Publishing Rules

Complete this step if you decided to use any of the default mappers, publishers, and publishing rules created during installation. If you want to create new mappers, publishers, and publishing rules, skip to the next step, "Step B. Add Mappers, Publishers, and Publishing Rules".

• LdapUserCertMap (see "LdapUserCertMap Mapper")
• LdapCrlMap (see "LdapCrlMap Mapper")
• LdapCaCertMap (see "LdapCaCertMap Mapper")

• LdapCaCertPublisher (see "LdapCaCertPublisher Publisher")
• LdapCrlPublisher (see "LdapCrlPublisher Publisher")
• LdapUserCertPublisher (see "LdapUserCertPublisher Publisher")

• LdapCrlRule
• LdapCaCertRule
• LdapUserCertRule

You can modify a mapper by editing its configuration parameter values; you cannot change the name of a mapper. To change the name of a mapper, you need to create a new mapper exactly like the mapper you want to rename, except with a new name, and delete the old mapper.

1. Log in to the CMS window for the Certificate Manager (see "Logging In to the CMS Window").
2. Select the Configuration tab.
3. In the navigation tree, select Publishing, and then select Mappers.

The right pane shows the Mappers Management tab, which lists configured mappers.



4. In the Mapper list, select a mapper that you want to modify.

For the purposes of completing this instruction, assume that you selected the mapper named LdapUserCertMap.

5. Click Edit/View.

The Mapper Editor window appears, showing how this mapper is configured. An example is shown below.



6. Make the necessary changes and click OK.

You are returned to the Mappers Management tab.

7. To modify the remaining mappers, repeat steps 4 through 6.
8. Click Refresh to see the update status of all the mappers.

Modifying a publisher involves changing its configuration parameter values; you cannot change the name of a publisher. To change the name of a publisher, create a new publisher using the same publisher plug-in module with the same parameter values, and delete the old one.

1. In the navigation tree, select Publishing, and then select Publishers.

The right pane shows the Publishers Management tab, which lists configured publishers.



2. In the Publisher list, select a publisher that you want to modify.

For the purposes of this instruction, assume that you selected the publisher named LdapUserCertPublisher.

3. Click Edit/View.

The Publisher Editor window appears, showing how this publisher is currently configured.

4. Make the necessary changes and click OK.

You are returned to the Publishers Management tab.

5. To modify the remaining publishers, repeat steps 2 through 4.
6. Click Refresh to see the update status of all the publishers.

Modifying a publishing rule involves changing its configuration parameter values; you cannot change the name of a publishing rule. To change the name of a publishing rule, create a new rule with the same parameter values, and delete the old one.

1. In the navigation tree, select Publishing, and then select Rules.

The right pane shows the Rules Management tab, which lists configured publishing rules.



2. In the Rule list, select a publishing rule that you want to modify.

For the purposes of this instruction, assume that you selected the rule named LdapUserCertRule.

3. Click Edit/View.

The Rule Editor window appears, showing how the rule is currently configured.

4. Make the necessary changes and click OK.

You are returned to the Rules Management tab.

5. To modify the remaining rules, repeat steps 2 through 4.
6. Click Refresh to see the update status of all the rules.

Complete this step if you need to create new mappers, publishers, or publishing rules. For example, if you already configured the Certificate Manager for publishing all types of certificates in "Step A. Modify the Default Mappers, Publishers, and Publishing Rules", you can skip to the next step, "Step A. Specify CRL Details".

• Step B.1. Create a Mapper for the CA Certificate
• Step B.2. Create a Mapper for End-Entity Certificates
• Step B.3. Create a Publisher for the CA Certificate
• Step B.4. Create a Publisher for End-Entity Certificates
• Step B.5. Create a Publishing Rule for the CA Certificate
• Step B.6. Create Publishing Rules for End-Entity Certificates

Creating a mapper for the CA certificate involves creating an instance of the mapper module that enables the Certificate Manager to locate the CA's entry in the directory; for a list of modules, see "Overview of Mapper Modules". Later, when creating the LDAP publishing rule for the CA certificate, you specify the mapper you create here.

1. In the navigation tree of the CMS window, under Publishing, select Mappers.

The right pane shows the Mappers Management tab, which lists configured mappers.

2. Click Add.

The Select Mapper Plugin Implementation window appears. It lists registered mapper modules.

3. Select a module.

The following choices are the ones provided by default with the Certificate Manager for mapping a CA's certificate to the CA's directory entry. (If you have registered any custom mapper modules, they too will be available here for selection.)

LdapDNCompsMap. Select this if you want the server to locate the CA's entry by formulating the entry's distinguished name from components in the certificate subject name and using it as the search DN. For details, see "DN Components Mapper".

LdapDNExactMap. Select this if you want the server to locate the CA's entry by searching for its certificate subject name. For details, see "Subject Name Mapper".

LdapSimpleMap. Select this if you want the server to locate the CA's entry by formulating the entry's DN from components specified in the certificate subject name and attribute variable assertion (AVA) constants. For details, see "Simple Mapper".

LdapSubjAttrMap. Select this if you want the server to locate the CA's entry by searching for an LDAP attribute whose value matches the certificate subject name. For details, see "Subject Attribute Mapper".

For the purposes of this instruction, assume that you selected LdapDNCompsMapper.

4. Click Next.

The Mapper Editor window appears.

5. Enter the appropriate information:

Mapper ID. Type a unique name for the mapper that will help you identify it; use an alphanumeric string with no spaces.

baseDN. Type the DN from which the server should start searching for the CA's entry in the directory. If you leave the next field, dnComps, blank, the server uses the base DN value to start its search in the directory. For example, O=siroe.com.

dnComps. Type DN components (attributes) separated by commas, that you want the server to use to locate an LDAP entry that match the CA's information. The server gathers values for these attributes from the CA certificate subject name and uses the values to form an LDAP DN, which then determines where in the LDAP directory the server starts its search. For example, if the subject name of your CA's certificate is
CN=testCA, O=siroe.com, C=US, and you set dnComps to use the O and C attributes of the DN, the server starts the search from the O=siroe.com, C=US entry in the directory.

If you leave the dnComps field empty, the server checks the value in the baseDN field and searches the directory tree specified by that DN. The server searches the entire LDAP tree for entries matching the filter specified by filterComps parameter values.

filterComps. Type components the server should use to filter entries that result from the search. The server uses the filterComps values to form an LDAP search filter for the subtree. The server constructs the filter by gathering values for these attributes from the certificate subject name; it uses the filter to search for and match entries in the LDAP directory.

If you need additional details about any of these parameters, click the Help button.

6. Click OK.

The Mappers Management tab appears, listing the new mapper.

Creating a mapper for end-entity certificates involves creating an instance of the mapper module that enables the Certificate Manager to locate the correct end-entity entry in the directory; for a list of modules, see "Overview of Mapper Modules". Later, when creating the publishing rule for end-entity certificates, you specify the mapper you create here.

Creating a publisher for the CA certificate involves creating an instance of the publisher module that enables the Certificate Manager to publish the CA certificate to the correct attribute in the CA's directory entry; for a list of modules, see "Overview of Publisher Modules". Later, when creating the LDAP publishing rule for the CA certificate, you specify the publisher you create here.

1. In the navigation tree of the CMS window, under Publishing, select Publishers.

The right pane shows the Publishers Management tab, which lists configured publishers.

2. Click Add.

The Select Publisher Plugin Implementation window appears. It lists registered publisher modules.

3. Select the module named LdapCaCertPublisher.

As explained in "CA Certificate Publisher", only this module publishes the CA certificate to caCertificate;binary attribute in the CA's directory entry. (If you have registered any custom publisher modules, they too will be available here for selection.)

4. Click Next.

The Publisher Editor window appears.

5. Enter the appropriate information:

Publisher ID. Type a unique name for the publisher that will help you identify it later; be sure to use an alphanumeric string with no spaces.

caCertAttr. The field shows caCertificate;binary, the directory attribute to publish the CA certificate. Leave it as it is. If the field is empty, type caCertificate;binary.

caObjectClass. The field shows certificationAuthority, the object class for the CA's entry in the directory. Leave it as it is. If the field is empty, type certificationAuthority.

6. Click OK.

The Publishers Management tab appears, listing the new publisher.

Creating a publisher for end-entity certificates involves creating an instance of a publisher module that enables the Certificate Manager to publish an end-entity certificate to the correct attribute in the end entity's directory entry; for a list of modules, see "Overview of Publisher Modules"Later, when creating publishing rules for end-entity certificates, you specify the publisher you create here.

Creating a publishing rule for the CA certificate involves creating a rule that uses the mapper and publisher that you created for the CA certificate in the previous steps.

1. In the navigation tree, under Publishing, select Rules.

The right pane shows the Rules Management tab, which lists configured publishing rules.

2. Click Add.

The Select Rule Plugin Implementation window appears. It lists registered modules that enable creating of publishing rules.

3. Select the module named Rule.

This is the default module. (If you have registered any custom modules, they too will be available for selection.)

4. Click Next.

The Rule Editor window appears.

5. Enter the appropriate information:

Rule ID. Type a unique name for the rule; use an alphanumeric string with no spaces.

enable. Select this option.

predicate. Type HTTP_PARAMS.certType==ca, indicating that the rule be applied to the CA certificate only. (For information on predicates, see "Using Predicates in Policy Rules".)

type. Select cacert.

mapper. Select the mapper you added for locating the CA's entry in the directory.

publisher. Select the publisher you added for publishing the CA's certificate to the directory.

6. Click OK.

The Rules Management tab appears, listing the new rule.

Creating a publishing rule for end-entity certificates involves creating a rule for publishing each type of end-entity certificates the Certificate Manager will issue:

• SSL client certificates
• SSL server certificates
• Object signing certificates
• Registration Manager signing certificates
• OCSP responder certificates
• Router certificates

1. In the navigation tree, under Publishing, select Rules.

The right pane shows the Rules Management tab, which lists configured publishing rules.

2. Click Add.

The Select Rule Plugin Implementation window appears. It lists registered modules that enable creating of publishing rules.

3. Select the module named Rule.

This is the default module. (If you have registered any custom modules, they too will be available for selection.)

4. Click Next.

The Rule Editor window appears.

5. Enter the appropriate information:

Rule ID. Type a name for the rule; use an alphanumeric string with no spaces.

enable. Select this option.

predicate. Type HTTP_PARAMS.certType==client, indicating that the rule be applied to client certificates only (see Table 22.1).

type. Select certs.

mapper. Select the mapper you added for locating end-entity entries in the directory.

publisher. Select the publisher you added for publishing end-entity certificates (to the userCertificate;binary attribute of an end-entity entry in the directory).

6. Click OK.

The Rules Management tab appears, listing the new rule you just created for publishing end users' client certificates.

7. Repeat steps 1 through 6 for each type of end-entity certificate the Certificate Manager will issue. Use Table 22.1 for filling in the correct values in the type and predicate fields. (For information on predicates, see "Using Predicates in Policy Rules".)

If you don't want the Certificate Manager to publish CRLs to the directory, skip to "Step 5. Identify the Publishing Directory".

• Step A. Specify CRL Details
• Step B. Set the CRL Extensions
• Step C. Create a Mapper for the CRL
• Step D. Create a Publisher for the CRL
• Step E. Create a Publishing Rule for the CRL

You can specify information, such as the publishing interval, the CRL version (whether to include CRL extensions), and the signing algorithm the Certificate Manager should use for signing the CRL object.

1. In the navigation tree of the CMS window, select Certificate Manager, and then in the right pane, select the Revocation List tab.

   

2. In the Update Frequency section, specify the interval for publishing the CRL to the directory:

Every time a certificate is revoked, or taken off-hold. Select this option if you want the Certificate Manager to generate the CRL every time it revokes a certificate. Keep in mind that the Certificate Manager attempts to publish the CRL to the configured directory whenever the CRL is generated, in this case, every time a certificate is revoked. Publishing a CRL can be time consuming if the CRL is large. Configuring the Certificate Manager to publish CRLs every time a certificate is revoked may engage the server for a considerable amount of time; during this time, the server will not be able to service any requests it receives and will not be able to update the directory with any changes it receives.

Update at this frequency. Select this option if you want the Certificate Manager to generate CRLs at regular intervals. In this case, the server publishes the CRL to the configured directory at the interval you specify.

In the adjoining text field, type the interval, in minutes, at which the Certificate Manager should publish CRLs. For example, if you want the server to publish CRLs every day, you should type 1440 in this field.

with a skew of. If you configure the server to update the CRL automatically every time period, the server by default adds a 5 second skew to the next update time to allow time to create the CRL and publish it. For example, if you configure the server to update the CRL every 20 minutes, and if the CRL is updated at 16:00:00, the CRL will be updated again at 16:19:55. You can configure the skew by changing the default value, which is specified in seconds.
3. In the CRL Format section, specify the format for publishing the CRL:

Include expired certificates. Check this box if you want the server to include revoked certificates that have expired in the CRL.

Allow extensions. Check this box if you want to allow extensions in the CRL. If you enable this option, the server generates and publishes CRLs conforming to X.509 version 2 standard. If you disable this option, the server generates and publishes CRLs conforming to X.509 version 1 standard. By default, the server publishes version 1 CRLs. If you enable this option, be sure to set the required CRL extensions as described in "Step B. Set the CRL Extensions".

Revocation list signing algorithm. Select the algorithm the server should use to sign the CRL. If the Certificate Manager's signing key type is RSA, select MD2 with RSA, MD5 with RSA, or SHA-1 with RSA. If the Certificate Manager's signing key type is DSA, select SHA-1 with DSA.

4. To save your changes, click Save.

If the changes you made require you to restart the server, you are prompted accordingly. However, don't restart the server yet; you can restart it after you've made all the required changes.

Complete this step only if you configured the Certificate Manager to publish version 2 CRLs--that is, you selected the "Allow extensions" option in "Step A. Specify CRL Details".

1. In the navigation tree, under Certificate Manager, select CRL Extensions.

The right pane shows the CRL Extensions Management tab, which lists configured extensions.



2. To modify a rule, select it and then click Edit/View.
3. Change the information as appropriate.

Be sure to supply all the required values. Click the Help button for detailed information on individual parameters.

4. Click OK.

You are returned to the CRL Extensions Management tab.

5. To modify other rules, repeat steps 2 through 4.
6. Click Refresh to see the updated status of all the rules.

The Certificate Manager publishes the CRL to the certificateRevocationList;binary attribute of the CA's directory entry. (See "Required Schema for Publishing CRLs")

Creating a publisher for the CRL involves creating an instance of the publisher module that enables the Certificate Manager to publish the CRL to the correct attribute in the CA's directory entry. In the next step, described in "Step E. Create a Publishing Rule for the CRL", you specify the publisher you create here.

1. In the navigation tree, click Publishers.

The right pane shows the Publishers Management tab, which lists configured publisher instances.

2. Click Add.

The Select Publisher Plugin Implementation window appears. It lists registered publisher modules.

3. Select the module named LdapCrlPublisher.

Only this publisher module enables the Certificate Manager to publish the CRL to the certificateRevocationList;binary attribute of the CA's directory entry; for details, see "CRL Publisher". (If you have registered any custom publisher modules, they too will be available for selection.)

4. Click Next.

The Publisher Editor window appears.

5. Enter the appropriate information:

Publisher ID. Type a name for the rule; use an alphanumeric string with no spaces.

crlAttr. Make sure this field shows the directory attribute to publish the CRL, certificateRevocationList;binary. If necessary, type it in.

6. Click OK.

The Publishers Management tab appears, listing the new publisher.

Creating a publishing rule for the CRL involves creating a rule that uses the mapper and publisher instances that you created in the previous steps. To create a publishing rule:

1. In the navigation tree, click Rules.

The right pane shows the Rules Management tab, which lists any currently configured publishing rules.

2. Click Add.

The Select Rule Plugin Implementation window appears. It lists registered modules that enable creating of publishing rules.